elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-12-23 14:35:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

6.16_disable_rsync.sh

Browse Source
This commit is contained in:
thibault.dewailly 2016-04-13 14:12:57 +02:00
parent f408f6846e
commit 8b8547dc7d
69 changed files with 151 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
bin/hardening/1.1_install_updates.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.10_home_nodev.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.11_removable_device_nodev.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.12_removable_device_noexec.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.13_removable_device_nosuid.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.14_run_shm_nodev.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.15_run_shm_nosuid.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.16_run_shm_noexec.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.17_sticky_bit_world_writable_folder.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.18_disable_cramfs.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.19_disable_freevxfs.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.1_tmp_partition.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.20_disable_jffs2.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.21_disable_hfs.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.22_disable_hfsplus.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.23_disable_squashfs.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.24_disable_udf.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.25_disable_automounting.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.2_tmp_nodev.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.3_tmp_nosuid.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.4_tmp_noexec.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.5_var_partition.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.6.1_var_tmp_partition.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.6.2_var_tmp_nodev.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.6.3_var_tmp_nosuid.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.6.4_var_tmp_noexec.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.7_var_log_partition.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.8_var_log_audit_partition.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/2.9_home_partition.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/3.1_bootloader_ownership.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/3.2_bootloader_permissions.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/3.3_bootloader_password.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/3.4_root_password.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/4.1_restrict_core_dumps.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/4.2_enable_nx_support.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/4.3_enable_randomized_vm_placement.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/4.4_disable_prelink.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/4.5_enable_apparmor.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.1.1_disable_nis.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.1.2_disable_rsh.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.1.3_disable_rsh_client.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.1.4_disable_talk.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.1.5_disable_talk_client.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.1.6_disable_telnet_server.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.1.7_disable_tftp_server.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.1.8_disable_inetd.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.2_disable_chargen.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.3_disable_daytime.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.4_disable_echo.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.5_disable_discard.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/5.6_disable_time.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.10_disable_http_server.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.11_disable_imap_pop.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.12_disable_samba.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.13_diable_http_proxy.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.14_disable_snmp_server.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.15_mta_localhost.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

71
bin/hardening/6.16_disable_rsync.sh Executable file
View File

@ -0,0 +1,71 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#
# 6.16 Ensure rsync service is not enabled (Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
PACKAGE='rsync'
RSYNC_DEFAULT_PATTERN='RSYNC_ENABLE=false'
RSYNC_DEFAULT_FILE='/etc/default/rsync'
RSYNC_DEFAULT_PATTERN_TO_SEARCH='RSYNC_ENABLE=true'
# This function will be called if the script status is on enabled / audit mode
audit () {
is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then
ok "$PACKAGE is not installed"
else
ok "$PACKAGE is installed, checking configuration"
does_pattern_exists_in_file $RSYNC_DEFAULT_FILE "^$RSYNC_DEFAULT_PATTERN"
if [ $FNRET != 0 ]; then
crit "$RSYNC_DEFAULT_PATTERN not found in $RSYNC_DEFAULT_FILE"
else
ok "$RSYNC_DEFAULT_PATTERN found in $RSYNC_DEFAULT_FILE"
fi
fi
}
# This function will be called if the script status is on enabled mode
apply () {
is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then
ok "$PACKAGE is not installed"
else
ok "$PACKAGE is installed, checking configuration"
does_pattern_exists_in_file $RSYNC_DEFAULT_FILE "^$RSYNC_DEFAULT_PATTERN"
if [ $FNRET != 0 ]; then
warn "$RSYNC_DEFAULT_PATTERN not found in $RSYNC_DEFAULT_FILE, adding it"
backup_file $RSYNC_DEFAULT_FILE
replace_in_file $RSYNC_DEFAULT_FILE $RSYNC_DEFAULT_PATTERN_TO_SEARCH $RSYNC_DEFAULT_PATTERN
else
ok "$RSYNC_DEFAULT_PATTERN found in $RSYNC_DEFAULT_FILE"
fi
fi
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

1
bin/hardening/6.1_disable_xwindow_system.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.2_disable_avahi_server.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.3_disable_print_server.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.4_disable_dhcp.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.5_configure_ntp.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.6_diable_ldap.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.7_disable_nfs_rpc.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.8_disable_dns_server.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

1
bin/hardening/6.9_disable_ftp.sh
View File

@ -2,6 +2,7 @@
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#

2
etc/conf.d/6.16_disable_rsync.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

12
lib/utils.sh
View File

@ -117,6 +117,18 @@ add_line_file_before_pattern() {
sed -i "/$PATTERN/i $LINE" $FILE
FNRET=0
}
replace_in_file() {
local FILE=$1
local SOURCE=$2
local DESTINATION=$3
debug "Replacing $SOURCE to $DESTINATION in $FILE"
debug "sed -i 's/$SOURCE/$DESTINATION/g' $FILE"
sed -i "s/$SOURCE/$DESTINATION/g" $FILE
FNRET=0
}
#
# User manipulation
#